Privacy Policy
Effective Date: 27th April 2026
01. Purpose and Applicability
This Privacy Policy ("Policy") outlines the rigorous data governance frameworks established by Paradigm Confab ("Company", "we", "us", or "our") regarding the collection, processing, and cryptographic protection of data within the myPeshkar digital legal workspace ("Platform").
This Policy applies to all subscribing legal entities, law firms, independent practitioners ("Subscribers"), and their authorized personnel ("Users"). Recognizing the sacrosanct nature of attorney-client privilege, this Policy is structured to provide uncompromising confidentiality and compliance with prevailing corporate governance standards.
02. Statutory Roles: Fiduciary and Processor
In strict adherence to the Digital Personal Data Protection Act, 2023 (DPDPA) and allied global privacy frameworks, the operational roles are bifurcated as follows:
- Data Fiduciary (Controller): The Subscriber acts as the sole Data Fiduciary. The Subscriber retains ultimate ownership and accountability for all proprietary files, litigation dockets, client personally identifiable information (PII), and opposing party data ("Tenant Data") processed through the Platform.
- Data Processor: The Company operates exclusively as a Data Processor. We process Tenant Data strictly pursuant to the programmatic and documented instructions of the Subscriber, solely to facilitate Platform services. We do not exercise independent agency over Tenant Data.
03. Taxonomy of Processed Data
A. Administrative & Authentication Data
To provision accounts and enforce Role-Based Access Control (RBAC), we securely process organizational details, verified administrator credentials, email addresses, and session authentication tokens.
B. Tenant Data (Privileged Information)
This encompasses all user-generated content, including cause lists, forum allocations, juridical synopses, contract drafts, and evidentiary materials. This data remains logically isolated and encrypted.
C. Third-Party Authorization Tokens (OAuth)
If a User elects to synchronize external services (e.g., Calendar Sync), we securely encrypt and store API access and refresh tokens strictly for the duration of the authorized connection.
D. Telemetry & Audit Logs
We maintain immutable audit trails (timestamps, IP addresses, logical actions) to provide Subscribers with internal security oversight and to monitor overall infrastructure health.
04. Third-Party Integrations & Google API Limited Use
myPeshkar allows Users to integrate external platforms (such as Google Calendar, Apple Calendar, and Microsoft Outlook) to synchronize litigation dockets and hearing schedules.
Google API Data Usage & Disclosure
myPeshkar's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. To provide complete transparency, our interaction with Google user data is strictly defined as follows:
-
1. Data Accessed:
We request access exclusively to the
https://www.googleapis.com/auth/calendar.eventsscope. We do not access, read, or pull any pre-existing personal events from your Google Calendar. - 2. Data Usage: We use this access solely to create, update, and manage litigation hearing events (containing the Case Name, Forum, Bench, and Next Date) directly on your primary Google Calendar so you can view your schedule on your devices.
- 3. Data Storage: We securely store your Google OAuth Access Token and Refresh Token in our encrypted database to maintain the connection. We do not store a copy of your personal Google Calendar data on our servers.
- 4. Data Sharing: We do not share, transfer, or sell your Google API data (including tokens or calendar event structures) to any third-party data brokers, advertising networks, or AI model training systems.
05. Commercial Prohibitions
The Company processes data strictly to render the SaaS functionalities described in our Terms of Service. We categorically enforce the following restrictions:
- We DO NOT sell, rent, or broker Tenant Data.
- We DO NOT train artificial intelligence or machine learning models on your privileged case files without explicit, separate opt-in consent.
- We DO NOT utilize client PII for advertising or secondary commercial profiling.
06. Cryptographic Security & Infrastructure
We mitigate the risks of unauthorized access, accidental loss, or data exfiltration through defense-in-depth architecture:
-
Encryption Protocols Tenant Data is encrypted in transit using TLS 1.3 and at rest utilizing industry-standard AES-256 cryptographic algorithms.
-
Logical Tenant Isolation Data architectures are strictly siloed. Cross-tenant querying is programmatically blocked at the database level.
07. Law Enforcement & Compelled Disclosure
In the event the Company receives a binding subpoena, warrant, or court order ("Legal Demand") seeking access to Tenant Data, our policy is to immediately redirect the requesting authority to the Subscriber.
If legally compelled to produce data directly, the Company will provide the Subscriber with prompt written notice prior to disclosure—allowing the Subscriber time to assert legal privilege or seek a protective order—unless we are explicitly prohibited from doing so by statute or a judicial gag order.
08. Retention and Cryptographic Purge
Tenant Data is retained solely for the active lifecycle of the subscription. Upon termination of service, Subscribers are granted a predefined 30-day extraction window.
Upon expiration of this window, or upon the direct request of the Subscriber's Administrator, the Company executes a mandatory cryptographic purge. This ensures that all primary records, case histories, and associated database backups are permanently and irretrievably destroyed.
09. Grievance Redressal Mechanism
Because myPeshkar acts as a Processor, data subjects (such as a Subscriber's clients) seeking to exercise their rights to access, correction, or erasure must submit their requests directly to the Subscriber (the Fiduciary). We provide the necessary administrative tools to allow Subscribers to fulfill these statutory obligations.
For administrative data inquiries, or matters pertaining to DPDPA compliance, privacy breaches, or security disclosures, please contact our designated Grievance Officer: